# Privacy Policy

Version: 1.0.6 - Effective: 23 October 2026

## The short version

- Coaches use Luca to answer the people who message them. For those conversations, the coach decides what happens and we process them on the coach's behalf.
- We use AI models to read messages and draft replies. We don't use your messages to train AI models shared with other customers, and we don't sell personal data.
- Luca sends replies on its own (auto-send), which is on by default for every channel. You can switch any channel to review in Settings at any time, so replies wait for your approval.
- Luca doesn't import old conversations when you sign up. The one exception: when a coach connects Instagram or Messenger, Luca reads that account's recent conversations once to learn the coach's writing style. It keeps only the coach's own replies and discards the leads' messages. Disconnecting the channel deletes those replies.
- On setluca.com, analytics and ad measurement (PostHog and the Meta Pixel) are on by default and stop when you turn them off, as described in our [Cookie Policy](/cookies). In the app, advertising runs only if you allow it.
- You can ask us for a copy of your data, a correction, or deletion. If you're in the EU, you can also complain to the Spanish data protection authority (AEPD) or the authority in your own country.

## Who we are

Luca is a product of **SetLuca, LLC**, a limited liability company registered in the United States. SetLuca, LLC is the controller for the personal data this policy describes as ours.

- Registered address: 2810 North Church Street, Wilmington, DE 19802, United States
- Delaware file number: 10724331
- Privacy requests, data deletion, support, and everything else: [support@setluca.com](mailto:support@setluca.com)

We run Luca day to day from Spain, so the GDPR applies to the personal data we handle, and our lead supervisory authority is the **Spanish Data Protection Agency (AEPD)**, www.aepd.es. You can contact us directly at support@setluca.com.

## Two roles: what we decide, and what coaches decide

**Where we are the controller.** We decide how to handle:

- coach accounts: name, email, workspace membership, roles, settings, sign-in records
- billing: plan, subscription, invoices, payment status (card details are handled by Stripe)
- our website: visits, analytics and ad measurement (unless you turn them off), forms and subscriptions
- support and other messages you send us
- security and abuse prevention across the service

**Where we are the processor.** When a coach connects a channel, the people who message that coach (we call them leads) send messages that Luca stores and processes. For lead and conversation data, **the coach is the controller** and we process it on the coach's behalf, under our [Data Processing Agreement](/dpa) and the coach's instructions.

**If you messaged a coach who uses Luca:** the coach is responsible for your data and their own privacy notice applies. Contact the coach first. You can also write to us and we'll help you reach the right workspace, or pass your request on.

## What we collect

**Account data.** Name, email address, password (stored hashed) or the sign-in provider you used (Google or Facebook), workspace membership and role, settings, plan, and records of your acceptance of our terms. Each acceptance record holds the document versions you accepted, the date and time, and the IP address and browser user agent you accepted from.

**Billing data.** Plan, subscription history, invoices, billing address, tax details, and payment status. Stripe collects card details directly; we don't see full card numbers.

**Connected-channel data.** Account and profile identifiers, usernames, Page or bot details, access tokens (encrypted), granted permissions, messages, comments, attachments, voice notes, timestamps, delivery status, and interactions such as button taps. What's available depends on the platform, your permissions, and the features you use.

**Lead and conversation data (processed for coaches).** Lead names and handles, the platform-scoped IDs a platform gives us, message content, attachments and voice notes (with transcripts), qualification details, summaries and memories Luca derives, consent and opt-out records, bookings, and campaign and broadcast activity.

**Writing-style data.** Sample replies you paste in, replies you approve or edit in Luca, and, for Instagram and Messenger, your account's recent replies imported when you connect it (see below). Luca turns these into a voice profile you can read and edit in Settings.

**Instagram content insights.** For a connected Instagram professional account: your own posts' IDs, type, caption (shortened), link, date, and per-post metrics such as reach, likes, comments, saves, and shares. No follower lists or audience demographics.

**Ask Luca data.** Questions you ask Luca's in-app assistant and its answers. Ask Luca reads your own workspace data to answer; it doesn't send messages to leads.

**Business knowledge.** The offers, prices, and answers to common questions you give Luca, and any website pages or Instagram bio you add as knowledge sources. Luca reads these so its replies use your real details.

**Support and website forms.** What you send us by email, on social media, or through website forms.

**Technical data.** IP addresses, browser and device information, request IDs, usage events, and error diagnostics, plus app session replays where you've allowed them (see [Cookie Policy](/cookies)).

**AI assistants you connect.** You can connect an AI assistant, such as Claude, ChatGPT, or Cursor, to your workspace through our MCP server at mcp.setluca.com. On our consent screen you choose what it may do: read your workspace (leads, conversations, the review queue, bookings, campaigns, broadcasts, analytics, and settings), draft replies, operate the queue (approve and send drafts, book calls), or full access. Unless you also grant full message text, lead names and message text reach the assistant redacted. We record which assistant you connected, the permissions you granted, and when, and we handle each request it makes like any other API request (see Technical data). We never read your chats, memory, or files in the assistant; we receive only what it sends us to run a request. What we return is then handled by the assistant's provider, for example Anthropic or OpenAI, under that provider's own terms and privacy policy. The connection lasts until you disconnect it in Settings -> Developer -> Connected agents or delete your account.

## Past-reply import for writing style (Instagram and Messenger)

When a coach connects an Instagram professional account, or a Facebook Page for Messenger, Luca reads that account's recent conversations once, through Meta's official API, to learn how the coach writes. It reads again only if the coach reconnects the account.

- **What it reads:** the account's most recent conversations, up to **20**, and up to the **20 latest messages** in each, as Meta returns them. There's no date cutoff on our side; Meta decides which conversations count as recent and limits what it returns.
- **Why:** only to learn the coach's writing style. Luca doesn't use these replies for anything else.
- **What it keeps:** only the coach's own outgoing replies that are between 25 and 1,200 characters long, as writing-style samples. Luca stores the text of each reply, not its date.
- **What it discards:** messages from leads are part of what Meta returns, but Luca discards them during the import. They aren't stored as conversations or used for the voice profile.
- **Where you see it:** the samples appear under Writing style in Settings. Luca uses them, with your other writing-style data, as examples when it drafts replies (see "AI processing" below).
- **Background jobs:** the import runs as a background job. That job's history can hold the same replies, with their dates, until it expires (see "How long we keep information").

Apart from this, Luca doesn't import history. When you sign up, it doesn't backfill old inbox conversations, and it doesn't import past CRM or calendar data. Telegram has no import; Luca starts with messages that arrive after the bot is connected.

**How long we keep the samples, and how to delete them:** we keep them while the channel is connected. Disconnecting the channel in Settings deletes them. You can also delete them by deleting your account or emailing [support@setluca.com](mailto:support@setluca.com). Otherwise they're deleted 30 days after the plan ends, or when Meta sends us a data-deletion request for that account.

## Where the data comes from, and what you must give us

- **From you:** your account, billing, settings, writing samples, and anything you send us.
- **From the platforms you connect** (Meta, Telegram): messages, profile details, and the other data listed in the platform sections below.
- **From leads:** what people write when they message a coach.
- **From your device:** technical data and, unless you opt out, analytics.

You need to give us an email address, and billing details for a paid plan, to have an account. Without them we can't provide Luca. Everything else is optional, though some features won't work without it.

## How we use information, and our legal bases

Where the GDPR or similar laws apply, we rely on these legal bases for the data we control:

| What we do | Data | Legal basis |
| --- | --- | --- |
| Create and run your account and workspace, connect channels, receive and send messages, draft replies, run campaigns, broadcasts, follow-ups, and bookings you set up | Account, connected-channel, writing-style, and (as processor) lead data | Performance of our contract with you (Art. 6(1)(b)); for lead data, the coach's instructions under the DPA |
| Billing, invoicing, taxes, accounting | Billing and account data | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Support, service emails, and notices about changes | Account and support data | Contract (Art. 6(1)(b)) |
| Security, fraud and abuse prevention, debugging, keeping the service reliable | Technical data, account data | Legitimate interests in a secure, working service (Art. 6(1)(f)) |
| Product analytics inside the app (pseudonymous usage events) | Technical and usage data | Legitimate interests (Art. 6(1)(f)) in understanding and improving Luca; you can object or opt out at any time |
| Website analytics | Technical data, cookies | Legitimate interests (Art. 6(1)(f)) in measuring and improving our website; you can object or opt out at any time (Turn off in the banner, Privacy choices, or support@setluca.com) |
| Ad measurement on our website (Meta Pixel, and a hashed email sent to Meta if you fill in a website form) | Website events, Meta cookies and click IDs, IP address and browser data; hashed email if you fill in a form | Legitimate interests (Art. 6(1)(f)) in knowing whether our ads work; you can object or opt out at any time (the same switch as website analytics) |
| Account advertising with Meta (from the app) | Hashed email, device IDs, sign-up and subscription events | Consent (Art. 6(1)(a)) |
| Keeping our own records about coaches in our CRM, and sending product news to coaches | Name, email, account stage | Legitimate interests (Art. 6(1)(f)); marketing email to people who aren't customers only with consent. You can unsubscribe at any time |
| Responding to legal requests and enforcing our terms | Any relevant data | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |

We don't use personal data for decisions that produce legal or similarly significant effects about you based solely on automated processing (GDPR Art. 22). Luca ranks leads by how close they seem to buying and drafts replies; the coach decides what their business does with that.

## AI processing

Luca uses AI models to read messages, transcribe voice notes, classify and rank leads, draft and check replies, summarize conversations, and answer Ask Luca questions. To do that it sends the context a task needs (for example, the lead's messages, the conversation so far, the coach's offers and prices, and writing-style samples) to AI models through **OpenRouter**.

- **No shared training.** We don't use your messages or your leads' messages to train AI models shared with other customers. We ask OpenRouter to route requests only to model providers that don't store prompts or train on them, and voice-note transcription runs with zero data retention.
- **Your voice is a profile, not a trained model.** "Learning your voice" means Luca builds a per-coach profile (phrasing, openers, emoji, how you handle price) and keeps example replies. It uses them as instructions and examples when drafting. It doesn't fine-tune or retrain an AI model on your messages. Your edits update your profile, not anyone's model.
- **Text embeddings.** To search your workspace and remember context, Luca turns some text into numeric embeddings using Cloudflare Workers AI. These stay in your workspace.
- **AI can be wrong.** A separate check reads each draft for made-up prices or availability, tone, and language, but no check is perfect.

### Automatic replies

Auto-send is on by default for every channel. With auto-send on, Luca sends replies without the coach reviewing them first. The coach can switch any channel to review in Settings at any time. In review, replies wait for the coach's approval. Messages flagged urgent (for example, crisis language or medical red flags) are held for the coach. On Instagram, comment campaigns always send the public and private replies the coach wrote for that campaign; they never send AI-written text.

People who message a coach may be talking to an AI system. Luca is open about this: it never claims to be a person, and if someone asks whether they're talking to an AI, it says so. Coaches are also responsible for telling their leads where the law requires it (see our [Terms](/terms)).

## Meta platform data (Instagram and Messenger)

This section covers data we receive from Meta through Instagram and Messenger.

- **Instagram** connects through **Instagram Login** with an Instagram professional account. It doesn't need a Facebook Page.
- **Messenger** connects through **Facebook Login**, where the coach chooses a Facebook Page they manage.
- Signing in to Luca with "Continue with Facebook" is a separate Meta app and only gives us your name, email, and profile picture. To delete that data, delete your Luca account or email us.

What each permission is for:

| Permission | Data we use | Why |
| --- | --- | --- |
| `pages_show_list` | The list of Facebook Pages you manage (names and IDs) | To show the Pages you can connect and connect the one you pick |
| `business_management` | The business portfolio and business-owned Pages you're authorized to manage | To find and connect a Page owned through Meta Business |
| `pages_manage_metadata` | Webhook subscriptions for the selected Page | To receive new messages, delivery and read receipts, and button taps for that Page |
| `pages_messaging` | Messages people send your Page, their Page-scoped IDs and profile names, and the replies Luca sends | To show Page conversations in Luca and send your replies within Meta's messaging window |
| `pages_read_engagement` | Page details and the Page's recent conversations | To read your Page's information and run the one-time past-reply import for writing style (only your Page's own replies are kept) |
| `instagram_business_basic` | Your Instagram professional account's username, ID, and basic profile | To identify and display the account you connected |
| `instagram_business_manage_messages` | Direct messages, story replies and mentions sent to your account, senders' Instagram-scoped IDs and usernames, the replies Luca sends, and your account's recent replies | To show Instagram conversations in Luca, send replies within Meta's messaging window, and run the one-time past-reply import for writing style (only your own replies are kept) |
| `instagram_business_manage_comments` | Comments on your own posts, commenter IDs and usernames, and the replies Luca posts | To run comment campaigns you set up: when someone comments with your keyword, Luca posts the public reply and sends the private reply you wrote |
| `instagram_business_manage_insights` | Your own posts' metrics (reach, likes, comments, saves, shares; reach and impressions for stories), captions, links, and dates | To show content analytics in Luca |

How we treat Meta platform data:

- We use it only to provide the features above to the coach who connected the account.
- We don't sell it, license it, or use it for advertising, and we don't use it to build profiles for anyone other than that coach's workspace.
- We don't share it with other customers or use it to train AI models shared with other customers.
- We share it only with the subprocessors on our [providers page](/providers) that need it to run the service, and as required by law.
- When you disconnect a channel, Luca stops reading and sending on it straight away, deletes that channel's leads, conversations and history in Luca, including writing-style samples imported from it, and removes its stored access token.
- **Deletion through Meta.** If you remove Luca from your Facebook or Instagram settings and ask for your data to be deleted, Meta sends us a data-deletion request. We return a confirmation code and a status page at the status link we give you when you make the request, where you can follow it. We then delete the connected accounts and their stored access tokens, the leads, conversations, messages, media, and bookings that came in through them, comment-campaign records, and writing-style samples imported from them. We also delete Instagram post insights and the Instagram handle and follower count stored on the coach profile. What we keep afterwards, and for how long, is on our [data deletion page](/data-deletion).

## Telegram data

Telegram connects through the official Bot API with a bot token the coach creates. Luca receives the messages, attachments, and voice notes people send to that bot, plus the sender's Telegram user ID, name, and username as Telegram provides them, and sends replies from the bot. It can't read the coach's personal Telegram account or groups. Telegram requires each bot to have a privacy policy; coaches set one for their bot (see our [Data Processing Agreement (DPA)](/dpa)).

## Who receives information

- **Workspace members**, according to the role the workspace owner gives them.
- **The platforms you connect** receive the messages and actions you send through them. Their own terms and privacy policies apply.
- **Our providers**, listed with purpose, data, and location on our [providers page](/providers). They receive only what they need for their part of the service, and they're bound by confidentiality and data protection terms.
- **Tools you connect**, such as calendars, webhooks, the REST API, or an AI assistant through our MCP server, receive what you set them up to receive.
- **Authorities or courts**, only as described below.
- **A buyer or successor** if SetLuca is involved in a merger, acquisition, or sale of assets, under this policy's protections. We'll tell you before your data becomes subject to a different policy.

We don't sell personal data. On setluca.com, the Meta Pixel measures our ads until you turn it off. Account advertising from the app happens only with your consent (see below).

## Government and legal requests

Before we hand over personal data to a government or court, we check that the request is valid, that the requester has authority, and that its scope is reasonable. We challenge unlawful requests and push back on excessive ones. If we must disclose, we share only what the law requires, and we keep a restricted record of the request and our decision. We tell the affected customer unless the law forbids it, or telling them would put someone at serious risk or compromise a lawful investigation.

## International transfers

SetLuca, LLC is a US company and several of our providers process data in the United States (our main database runs in the United States). Some processing happens in Germany (Hetzner) and on Cloudflare's global network. When personal data from the EEA, the UK, or Switzerland goes to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and/or a provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions). The mechanism for each provider is on our [providers page](/providers). You can ask us for a copy of the relevant safeguards.

## Cookies and website measurement

Our [Cookie Policy](/cookies) lists every cookie and similar technology we use. In short:

- Cookies needed for sign-in, security, and remembering your privacy choice are always on.
- On setluca.com, analytics (PostHog) and ad measurement (the Meta Pixel) are on by default and share one switch. They stop as soon as you click **Turn off**.
- In the Luca app, analytics follow your choice in App privacy choices, and advertising runs only if you allow it.
- We honor Global Privacy Control (GPC) as a choice to turn them off.
- We keep your choice for 180 days, then ask again.

We run website analytics and ad measurement on the basis of our legitimate interest in understanding how people find and use our website, and whether our ads work. We keep it to that: no session recording, no heatmaps, and no message content.

**How to opt out:** click **Turn off** in the cookie banner, use the **Privacy choices** button at the bottom of every page on setluca.com (or **App privacy choices** in Luca's settings), or email [support@setluca.com](mailto:support@setluca.com). Opting out stops these tools from that point on, including app session replay when you opt out in the app. You can change your mind at any time from the same settings.

## Advertising choices

**On our website**, the Meta Pixel runs by default and stops when you click **Turn off** (see above). If you give us your email in a website form while it's on, we send Meta a hashed copy of that email with your IP address, browser, and Meta's click and browser IDs, to see whether one of our ads brought you. Once you turn it off, we send Meta nothing from the website.

**In the app**, account advertising is off until you allow it in App privacy choices. If you allow it, we send Meta a hashed email, your IP address and browser, available advertising and device identifiers, sign-up and subscription activity, and business profile categories, to measure our advertising. Hashing an email does not make it anonymous. We never send conversation content or lead data for this purpose.

Your account choice lasts up to 180 days and applies across browsers. You can withdraw it in App privacy choices without cancelling your account. Withdrawal stops future reporting but can't recall information already sent.

Under some US state privacy laws, advertising disclosures may count as a "sale" or "sharing" even when no money changes hands. You can opt out through Privacy choices and App privacy choices, and we honor GPC. When received on a signed-in app request, GPC withdraws account advertising consent.

## How we protect information

We encrypt connected-platform credentials at rest, keep secrets in a dedicated secrets manager, and restrict workspace access through authorization checks and team roles. We strip personal data and secrets from error reports, and our self-hosted services sit behind Cloudflare Access with no public ports. No system is perfectly secure. If a breach affects personal data, we'll tell affected coaches within 48 hours of confirming it, and we'll notify the AEPD and affected people as the law requires.

## How long we keep information

| Data | How long |
| --- | --- |
| Account and workspace data | While your account is open. Deleted when you delete your account or ask us to; we aim to delete within 90 days of the account closing |
| Lead and conversation data (leads, conversations, messages, attachments, memories, bookings) | While your plan is active. Deleted when you disconnect the channel, ask us, or delete your account, or when Meta sends a deletion request for that channel. Once our automatic deletion is switched on, we aim to delete it within 90 days of your subscription ending or being cancelled, including a trial that doesn't convert. You can ask for an export during the first 30 days after you cancel. |
| Writing-style samples | Deleted 30 days after your plan ends, or when you disconnect the channel, delete your account, or ask us, or on a Meta deletion request |
| Instagram post insights | While the Instagram account is connected; deleted on disconnect, account deletion, or a Meta deletion request |
| Channel access tokens | Until you disconnect the channel or delete your account |
| AI assistant connections and the keys issued to them | Until you disconnect the assistant or delete your account |
| Raw platform event payloads | 7 days |
| In-app analytics events stored by Luca | 90 days |
| Error reports, logs, and app session replays (Sentry) | Up to 90 days, then deleted |
| Background-job history (self-hosted Inngest) | Only as long as needed to run and troubleshoot the job, then deleted |
| Database backups (PlanetScale) | Kept for a limited period for recovery, then overwritten |
| Invoices and tax records | As long as tax law requires |
| Support emails | 24 months after the conversation ends |
| Records of terms acceptance (versions accepted, date and time, IP address, user agent) | 3 years |
| Records of deletion requests (confirmation code, dates, status; no content) | Only as long as needed to show we handled the request |
| Privacy choice cookie | 180 days |
| Marketing email list | Until you unsubscribe |

We may keep limited information longer when the law requires it or to resolve a dispute, and only for that purpose.

## Your rights

Depending on where you live, you may have the right to:

- access your personal data and get a copy
- correct it
- delete it
- restrict or object to processing, including processing based on legitimate interests (such as analytics) and any direct marketing
- receive your data in a portable format
- withdraw consent at any time, without affecting earlier processing
- not be subject to solely automated decisions with significant effects

To make a request, email [support@setluca.com](mailto:support@setluca.com) with the subject "Privacy". Say which account or workspace it's about. We verify your identity and authority before releasing or deleting information, and we answer within one month (extendable by two months for complex requests, in which case we'll tell you why). Don't send passwords or access tokens with your request. Deletion steps are also on our [data deletion page](/data-deletion).

If your request is about a coach's conversation with you, we'll pass it to that coach, who is the controller, and help them respond.

**Complaints.** You can complain to the **Spanish Data Protection Agency (AEPD)** (Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es) or to the data protection authority in the EU or EEA country where you live or work, or where you think an infringement happened. We'd appreciate the chance to fix it first, but you don't have to contact us before going to an authority.

**US residents.** Depending on your state, you may have rights to know, access, correct, delete, and opt out of the sale or sharing of personal information and of targeted advertising. We don't discriminate against you for using them. You can use an authorized agent; we'll verify the request. If we deny a request, you can appeal by replying to our answer.

## Children and sensitive information

Luca is for business users aged 18 or older. We don't knowingly collect personal data from children through our website or accounts.

Coaches must not use Luca to collect or process minors' personal data or regulated medical records. People sometimes share health details in messages anyway. When they do, the coach is responsible for having a lawful basis for that data under GDPR Art. 9, and Luca processes it only under the coach's instructions. Luca flags some sensitive messages, such as medical red flags, crisis language, or a lead who says they're a minor, as urgent and holds them for the coach. Flagging doesn't mean every message is screened.

If you believe a workspace contains information it shouldn't, contact [support@setluca.com](mailto:support@setluca.com) so we can look into removing it.

## Marketing email

Subscription emails include an unsubscribe link. Unsubscribing from marketing doesn't stop messages we need to send to administer an account or answer a request.

## Changes to this policy

We publish updates here with a new version and date. If a change materially affects how we use personal data, we'll tell account owners by email at least 30 days before it takes effect and ask for consent where the law requires it.

## Contact

Privacy and deletion requests, and general questions: [support@setluca.com](mailto:support@setluca.com) - SetLuca, LLC, 2810 North Church Street, Wilmington, DE 19802, United States

Related: [Terms of Service](/terms) - [Data Processing Agreement](/dpa) - [Providers](/providers) - [Cookie Policy](/cookies) - [Data deletion](/data-deletion) - [Trust](/trust)